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Abstract 

The Certification of Propulsion Systems is costly and complex, involving development 
and qualification testing. The desire of the certification process is to assure all requirements can 
be demonstrated to be compliant. The purpose of this paper is to address the technical design 
concerns of certifying a propulsion system for flight. Presented are Pressurization, Tankage, 
Feed System and Combustion Instability concerns. Propulsion System Engineers are challenged 
with the dilemma for testing new systems to specific levels to reduce risk yet maintain budgetary 
targets. A methodical approach is presented to define the types of test suitable to address the 
technical issues for qualifying systems for retiring the risk levels. Experience of the lessons 
learned from supporting the Shuttle Program for Main Propulsion and On Orbit Propulsions 
Systems as well as previous collaborations on design concerns for certifying propulsion systems 
are utilized to address design concerns and verification approaches. 


introduction 

The purpose of qualification and development testing is to address those areas of flight 
hardware where performance cannot be address by analysis, design and/or by similarity. 
Mathematical modeling and verification by similarity are tools that can be used when 
environmental and geometrical conditions of specific systems are similar. Solving the extent of 
the amount of testing and the level of fidelity (flight hardware) are economical challenges for the 
customers and developer. On one end of the budget spectrum, one can require a full 
qualification test article that has identical fluid geometries (tube bends, component geometry and 
system attachments) and is tested to representative environmental conditions (i.e. altitude, 
thermal, vibration and shock conditions); on the other end, development testing can be 
considered to satisfy minimum ambiguities of the design (e.g. low inlet pressures to induce 
chugging). The following questions are topics that deserve discussion to guide the design team 
to determine the types of testing and the fidelity of the hardware required to assure requirements 
can be demonstration. 


Results and discussion 


Test Considerations 

Qualification and development testing is performed to address ambiguous design areas 
that cannot be addressed by analysis/similarity and to demonstrate requirements can be met with 
minor hardware modifications. If major hardware changes are made to existing hardware, high 
fidelity testing is required because many variables that influence the interaction of components 
are difficult to account for in modeling. Many design concepts are attempted to be verified by 
analysis and similarity; however, evaluating the need for a test, specifically for propellant 
systems, identifies whether requirements can be demonstrated. Answering the questions for why 
should a test be conducted identifies the magnitude of the test required: 
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1 . Is the system significantly different than what has been tested or flown? 

2. Are there areas of the design significantly different that complex fluid, thermal and 
combustion conditions cannot be characterized by analysis, by analytical modeling or by 
test similarity? 

If differences in system design and environments cannot be modeled with confidence or 
similarity cannot be applied, testing is required to address the above questions. If these 
questions are answered to the level that analysis, geometrical and environmental conditions 
cannot be predicted, testing is required to the level of demonstrating requirements to within a 
desired envelope to retire risks. The need for a test is driven by requirements that cannot be 
satisfied by analysis or test similarity. Complex operations (e.g. addressing combustion 
instability) can be produced during a test to characterize the ambiguous design areas, and then 
shown by math models that these ambiguous areas can be avoided by system design. 

Resolving what areas of the design should be tested and why are discussions and trades that are 
addressed by the design team which has applicable hardware experience and has analyzed the 
areas of concern. The following are potential subsystem areas of design concern (based on the 
X37 propulsion system design activity and lessons learned from other program): 


Pressurization Systems 

There are several techniques used to pressurize propellant storage systems (e.g. 
mechanical pressure regulators or a pressure modulating system with electrical isolation valves) 
which present short and long term storage issues. When ullage pressure and thermal sensitivities 
with respect to low inlet engine pressure are distinctively different than previous systems, system 
level testing may be needed depending on the engine burn required. If the engine burn is long 
where the helium pressurant decreases to significantly colder temperature, insufficient helium 
mass to meet ullage pressure will result in low engine inlet. This design area is defined by the 
sensitivity of the Mission Duty Cycles required and the qualification demonstration of the engine 
at low inlet pressures. If heavy pulse operation for long durations is required and the engine 
design and performance is sensitive to low inlet pressure, subassembly level testing may be 
required to address thermal effects with respect to overshoot and undershoot for small and large 
ullage volumes, respectively. Tests should be defined to demonstrate the pressure control 
requirements for long heavy duty cycle pulses and long engine burns. If long steady state burns 
are required, analytical methods can be used to provide verification by analysis and similarity 
provided good similarity and model correlation accuracy exist. 

Other sensitive issues related to pressure regulating systems are specific to the types of 
propellant used. If monomethyl hydrazine (MMH) and nitrogen tetroxide (NTO) propellants are 
used, propellant particulate and propellant vapor migration tend to react with the seating areas of 
the isolation mechanism which lead to internal leakage and hardware deterioration. These types 
of issues cannot be addressed by mathematical modeling; but can be assessed by long term 
exposure tests where hardware is exposed to propellant vapors per planned usage. Materials can 
be selected based on the experience gained from other systems; however, the relating 
mechanism is required to demonstrate long term exposure to propellant vapor migration. 


Propellant Tankage Systems 

Micro-gravity tanks are complex in design and are required to supply propellant under 
dynamic environments (e.g. micro-gravity, acceleration and/or torque disturbances). Several 
creditable tank manufactures have proven many design concepts. Although each tank is 
different with respect to Design Reference Missions (DRMs), new tanks require a development 
and qualification path to verification. If the tank level verification process demonstrates 
requirements and passes qualification successfully, flight type tanks are not needed to perform 
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system level testing. Computational fluid dynamics (CFD) analyses can demonstrate or 
determine the fluid location during micro-gravity conditions. When sufficient margin (5 to 10% of 
propellant required) is embedded into the propellant budgets, a low micro-gravity test is not 
required. CFD tools demonstrate fluid positions for the flight environments and no verification 
testing is recommended for demonstrating expulsion techniques or requirements. If minimum 
propellant margin is driven to reduce weight and propellant consumption accuracies are 
questionable, KC-135 low-gravity tests can be used to ascertain limited expulsion efficiencies. 
Although real space environments will not be addressed until a mission is executed, minimum 
propellant margins are recommended within 3 to 5% of total propellant volume. Because of this 
position, a high fidelity propellant gauging system will be required to offset the low propellant 
margin. 

For addressing system ground tests, run-type (ground) tanks can be used to simulate a 
storage vessel. When thermal control is uncertain or ambiguous, or fail-on heater control, 
environmental heating during station keeping or re-entry effects impact propellant conditions, 
evaluation of propellant temperatures with helium solubility effects are recommended to 
understand the interaction between propellant feed operation and combustion effects. If the 
heating environment is long in duration or erratic, ullage pressure control should be 
demonstrated within the pressure design limits. Large bulk volumes of propellant (400 to 1000 
lbs) usually required large heat rates to increase ullage pressure. If propellant temperatures are 
allowed to increase (100 to 120 °F), two critical events can occur: 1.) Vapor pressure can 
increase to the level of maximum expected operating pressure (MEOP) and 2.) Engine 
performance can decrease at high temperatures. The impacts of these areas can be addressed 
by analysis; however, hot and cold propellant temperatures are recommended to be tested to 
address the interaction of propellant conditioning with engine combustion. 

Propellant Feed Systems 

Most satellites that are launched as a payload required dry feed systems during launch 
and require three mechanical inhibits to avoid a critical hazard event (i.e. propellant leakage). 
Because of this requirement, most feed systems are launched dry and have to demonstrate 
propellant filling operations within the feed system. Priming with normal operating tank pressures 
(200 to 350 psia) drives high feed system peak pressures. Although this design approach has 
been demonstrated on the Compton Gamma Ray Observatory (CGRO) propulsion system (with 
anomalies) and Boeing 601 satellites, ambiguity may exist at engine(s) start. Therefore some 
testing at the component level or a development or qualification feedsystem test can 
demonstrate quality priming. 

Other areas of concern involve engine feedback interaction under severe engine duty 
cycles. This design area should be addressed by analysis and by test to demonstrate sufficient 
pressure margin maintains engine inlet pressures above the frequency response between the 
propellant feed system and the normal periodic heat release of the reacting propellants. The 
concern between propellant feed system and engine pressure oscillations is that of the 
interaction of the feed system response and combustion chamber pressure oscillations. If 
engines are coupled with the propellant feed system, pressure oscillations can occur at rocket 
engine feed pressures below the nominal design inlet pressures. The primary driving source of 
low frequency pressure oscillation in the combustion chamber is caused by the normal periodic 
heat release of the reacting propellants. When the pressure oscillations travel upstream through 
the injector and valves and couple with the feed system and amplify the chamber pressure 
oscillations, this phenomenon is known as feed system chugging, where chugging can occur at 
high, mid and low frequencies. In past tests, rocket engines have exhibited low frequency 
pressure oscillations at approximately 150 to 300 FHz. 

A cold flow test with referee fluids can be used to demonstrate pressure margins are 
established above the engine inlet design limits. System characteristics can be addressed for 
specific engine inlet conditions; however, engine pressure envelopes need to be well 
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established. In one-dimensional modeling tools such as Easy 5 (™), a forcing function can be 
inputted as engine pressure oscillations and the concern of operation within a dynamic 
resonance (e.g. 150 to 300 Hz) can be addressed to show frequency response is avoided for 
specific inlet pressures. The exact mechanism cannot be modeled; however, by demonstrating 
sufficient pressure margins, low frequency pressure oscillations can be avoided. If ullage 
pressures are driven by design limits (e.g., weight and low MEOP), then hot fire testing is 
recommended to demonstrate that low frequency pressure oscillations are avoided and 
understood to establish operating requirements. 


Engine Systems 

Critical engine performance and life characteristics, such as overall expected firing duty 
cycles, thermal cycles, heavy pulse mode operations, total propellant through put, total thermal 
and pulse cycles, and gas ingestion, need to be demonstrated by test and/or by accumulated 
information that has been provided by test results. Low inlet pressures and total system pressure 
loss assist in determining the tank operating pressure and answer the characteristic of engines 
turning off and on under the stringent cases of a mission duty cycle. Careful review of the 
mission duty cycles can be compared with previous engines to determine if engine as well as 
system level test are needed. Inlet conditions (pressure, temperature and flowrates) need to be 
demonstrated to assure nominal and off nominal (including failure) boundaries of a system are 
established. If combustion instability is not an issue under the nominal operating envelopes, 
testing can aid and support definition of the design inlet conditions. If combustion instability 
surfaces to be an issue, testing at the engine and possibly integrated engine-feed system levels 
is required to verify the various inlet conditions will not cause engine instability. If an ambiguous 
or problematic area of an engine design is revealed in performance or life, then the repeatability 
of that characteristic is key in understanding and controlling that area of concern. Once 
repeatable behavior is established for the questionable conditions or areas of concern, system 
test boundaries and operating envelopes are defined to establish nominal operating envelopes. 
Off nominal conditions should also be tested to define the operating limits. 


System Conditions 

The propulsion system needs to be evaluated for unique operating conditions and 
environments which affect the performance of the integrated system. Existing test and similarity 
data of previous systems can be used to address the specific conditions. Examples of specific 
conditions include: ground processing, including propellant loading processes; long term 
propellant exposure to pressurization systems, including effects of propellant vapor migration; 
and long term propellant exposure to materials and resultant system effects. Requirements can 
be defined for long term storage; however, testing duration (e.g. years) will not lend itself to 
address the qualification aspect of the requirements. Therefore, determining how much testing is 
sufficient to verify the requirements presents the dilemma of verifying the effects of long term 
exposure. Long term propellant exposure can be addressed in part by previous applications and 
demonstrated techniques and designs for Space Shuttle propulsion systems. 

Test Considerations 


Test information critical to the design is defined by a pass-fail criterion and the defined 
operating constraints specific to the components. Instrumentation (flight and test) and flow 
metering (with appropriate data acquisition), pictures and videos provide the basis for 
understanding system performance behavior. Once repeated behavior is accomplished for 
nominal and off nominal cases, the pass-fail criteria are used as a tool to assure the ambiguous 
areas (e.g., design tolerances, repeatability, etc.) have been addressed. The pass-fail criterion is 
the target and the road map to a successful design. Test(s) information and the criteria are used 
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to assure the design is acceptable and meets requirements and all produced end items are 
repeatable and accepted. 

What criteria should be applied to the verification process to assure requirements are 
met? A compliance method should be used to assure the verification processes always verifies 
that the system requirements have been demonstrated. By reviewing a standard verification 
process and by evaluating the compliance, a criteria definition for the type of verification process 
can be derived which assures requirements are demonstrated by analysis, inspection, 
demonstration, test or similarity. Consulting with experts that have designed and flown space 
systems assure lessons learned have been captured and assure key engineering and project 
personnel are prepared to accept the verification process. 

A budget estimate or target cost is required to address the program affordability and to 
address the technical design issues. Once the issues are identified, cost of flight like hardware, 
required propellant, and required test facility and engineering staff can be defined to assure the 
technical issues will be addressed with the target cost. System level tests and the fidelity of the 
flight-like hardware coupled with simulated environments provide the avenue for addressing 
overall design as well as ambiguous and repeatability concerns. 

The overall test schedule should be based on technical risk and technology and design 
maturity. Ideally, development tests should start at Preliminary Design Review (PDR) time 
frame and be completed at or after Critical Design Review (CDR) to implement design changes 
prior to system production. Since ideal planning rarely prevails, identifying the risks and planning 
to retire the risks prior to CDR assist to avoid hardware changes. The remaining testing post 
CDR or post Mission Requirements Review (MRR) should be definition of operating limits rather 
than testing component limits, 


Verification Testing 

Prior to progressing to a verification approach, it is recommended that defined and 
undefined requirements be identified and the associated methodology required for verification be 
determined. All the mission phases that are required and its associated system requirements 
need to be defined in a specification in order to flow down the test requirements. Once the 
requirements are identified, bench level testing and/or subassembly testing can be derived to 
evaluate and verify the interaction between subassemblies (e.g. feed system and engine 
manifolds). If development tests can address the quest for the unknown performance 
characteristics and capture verification for requirements, the test objectives should address those 
areas of concern and define the limits of the requirements for acceptance. The next step should 
be to address the variance of the requirements, design characteristics, and operational 
characteristics that will affect system design and performance within the operational phases, 
such as pre-launch, launch, on-orbit and de-orbit. Using the X37 propulsion system as a case in 
point, the following are recommendations for addressing flight issues for the verification process: 


Pre-Launch 


As an example, for the X-37 vehicle, no new pre-launch processes were implemented. 
Typical propellant loading techniques (utilizing Shuttle commercial satellite approaches) were 
proposed. The feed systems will be launched wet and the propellant tankage system will be 
loaded to a 95% fill fraction of the total tank volume. During filling, the tank will be vented to a 
low pressure (1 to 5 psig) prior to filling the tank. A low helium pad pressure of 25 to 60 psia will 
top off the propellant tank. Because the authors view this process as a heritage operation (i.e. no 
new technology or design concerns), no ambiguous area of concern is identified. These 
requirements can be verified by analysis coupled with test data. For this application, the design 
team did not recommend any testing in the loading operation to support verification in that phase 
of operation. During the design phase for defining the propellant tank propellant management 
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device (PMD), tank loading techniques were defined to assure successful tank loading by 
consulting with NASA/Kennedy Space Center Florida Operations. As part of the verification 
process for both the propellant tank PMD and vehicle ground processing, the tank and vehicle 
can be loaded with propellants to demonstrate successful tank loading prior to launch without a 
test. 


Mission- (Ascent. On-Orbit & De-Orbit, Re-Entrv/Landing) 

For the X-37 vehicle example, the vehicle plan is to insert to a 150 nmi altitude orbit via 
an Evolved Expendable Launch Vehicle (EELV). Overall, the X-37 vehicle is required to perform 
the following propulsion related activities: stage separation maneuvers, on-orbit attitude hold, 
orbit transfers, RCS maneuvers, de-orbit, null burns and earth re-entry attitude control. The 
following system issues are recommended to be addressed: 

• Pressure modulation: System regulation of propellant tank pressurization and effects of 
avionics command and response. Address time dependent constraints. 

• Helium saturation gas effects on system operation and performance. This is tank 
pressure and feed system dependent. Address evolution of helium for low inlet 
pressures. 

• If feed system is launched dry, testing is required to address feed system activation 
(Priming). Address MEOP/pressure spike on components. 

• Dynamic feed system interactions: Address effects on thruster performance, life and 
stability. 

• Long life propellant exposure issues. Address propellant vapor migration and potential to 
generate iron nitrate problems with specific materials with resultant contamination and 
performance related effects. 

• Propellant quantity control: Address constraints on re-entry mass while assuring 
adequate propellant to accomplish re-entry attitude control functions 

• Propellant pressure control: Address pressure control during post re-entry phases 
associated with heat transfer into the propellant system 


Post Flight Ground Operations 

Consideration of ground processing of propellant-contaminated systems (e.g., reusable 
systems) and the interactions with water vapor in the atmosphere which affects system life 
should be strongly considered. However, the interaction process in terms of years does not lend 
itself to an acceptable timeline for verification. Applications (design and operational approaches) 
from Space Shuttle Orbiter may provide technical data, historical precedents, and test 
applications which address similar requirements. Examples such as propellant vapor migration 
cause significant problems that actively affect pressurization systems (due to constant exposure 
to propellant vapor and resultant material reactions). Lessons learned from materials and 
reaction of propellant vapor will support the verification process. 


Test Approach 

The following are conditions that are complex and have ramifications for defining the 
verification approach for system tests. System issues that cannot be addressed by analysis and 
similarity include, but are not limited to: 

• Engine combustion interaction with feed system capacitances are unity and cannot be 
modeled. Subjects, such as, high and low frequency pressure oscillations and feed 
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system capacitance with multiple engines, are difficult topics to resolve without testing. 
Therefore, if such topics are of concern, testing is recommended if engine inlet 
conditions are challenged outside the operating envelope. This is recommended to 
address the combustion issues at low inlet pressures. 

• When thermal environments are the sole effect on system performance, testing can be 
eliminated; however, when thermal environments impact other design issues (e.g. heat 
transfer between components), system testing will be required to simulate flight 
conditions. An alternative is to simulate environments by insulating the propellant lines to 
simulate reduced heat transfer (e.g. zero convection). 

• Effects of helium saturation need to be assessed on different inlet conditions to eliminate 
the concern of engine instability. 

• System contamination which affect soft goods or valve seats (i.e. NTO reacting with 
materials or ambient conditions) are effects which cannot be modeled and require 
isolated testing to characterize component performance. 

• Integrated avionics, software, propulsion systems require interaction time delays and 
response with flight hardware. 


Propulsion System Test Objectives 

Determining the type of test required to address feed system and engine performance 
involves the consideration of hot fire system and engine testing, a hydraulic water flow (cold 
flow) test, or an avionic integrated control test. The identified test requirements derived from the 
system requirements define the test objectives which will drive the type and level of testing 
required. The following are the types of tests and the objectives that can be accomplished: 

1. Engine system hot fire test will demonstrate the following: 

• Actual mission duty cycles (MDC), which will allow anchoring of the math models to 
address system interactions and specifically requirements. Validation of math models 
will provide an avenue for a certification process for verification of additional or modified 
MDCs. 

• Feed system operation, pneumatic system activation and surge pressure performance 
with respect to requirements. Prior to the system test prepare pass/fail criteria to 
establish verification of requirements. 

• Propellant depletion and sating operations and performance and resultant verification of 
derived requirements. 

• Long term propellant and propellant vapor effects, on propellant and pressurization 
systems. These effects can be continued after completion of all performance tests and 
the test article can serve as a path finder (fleetleader article). 

• Ground processing procedures and operations with verification of requirements through 
testing 

• Evaluation of sensitive design areas where propellant-contaminated/air reaction affects 
valving Teflon soft goods, seals, and mechanical propellant interfaces. This can be 
performed with the test article; however, it is recommended that coupon test samples get 
started at the onset of program initiation. 

• Verification of acceptable levels of engine(s) chamber pressure interactions with feed 
system capacitance (i.e. feed system geometry and volume). This would include 
verification of thruster performance requirements (e.g. primarily based on engine inlet 
conditions meeting design requirements). 

• Verification of engine heat soak back effects or heat transfer to other engines, with 
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possible definition and verification of the restart requirements (e.g., if engines heat 
above operating limits, define the requirement for cool down prior to allowing restart). 

2. A cold flow test with simulated fluids (e.g. H20) will demonstrate the following: 

• Anchoring of feed system dynamic math models for MDC simulations at a hydraulic level 
(i.e. flow rate, pressure drops) and possible limited insight into feed system interactions 
(i.e., hydraulic effects) with engines. Delta pressure and timing characteristics of the 
engine valve, injector and chamber back pressure need to be simulated to demonstrate 
requirements. 

• Feed system operation, pneumatic system activation and surge pressure performance 
with respect to requirements (once correlated modeling tools are adjusted for propellant 
properties). 

• Low fidelity propellant dump/safing operations and performance with resultant 
verification of requirements via correlated modeling tools with actual propellants. 

In comparison to a hot fire test program, the following are objectives which will not be 
realized with a cold flow test (assuming simulated fluids): 

• Thruster chamber pressure feedback interaction with system cannot be verified. 

However, with the anchoring of the math model of the cold flow test, chamber pressure 
start and shut down transients can be evaluated and verification of inlet and pressure 
drop as well as timing and transient performance requirements can be completed. 

• Nozzle configurations and altitude effects can not be demonstrated or verified. 

• Simulated fluids do not have identical fluid properties (i.e., models need to address the 
variation of fluid property differences); therefore, corrections need to be made for 
verifying performance requirements with propellant properties. 

• Helium solubility effects with simulated fluids cannot be demonstrated (since 
characteristics are fluid dependent) so the evolution of helium and associated 
feedsystem compliance effects cannot be fully verified. 

• Vapor migration and environmental effects and reactions with materials cannot be 
demonstrated. 

• Thruster/engine heat soak back effects are not simulated; therefore, restart capability 
cannot be demonstrated. 

• Ground processing tests/de-contamination tests will be different because of different 
fluid properties and possibly due to overall fidelity of the cold flow test article with 
respect to the flight system design (e.g., cold flow test article typically do not include 
flight-like propellant tanks and PMDs); therefore, the need to address the effects of 
contamination cannot be demonstrated. 

If propellants are used with a cold flow test, the following test objectives can be realized: 

• Anchoring of math models for MDC simulations, will provide analytical insight (limited) 
into feed system interactions. Flow and pressure drop requirements can be verified. 

• Feed system and pneumatic system activation and surge pressures requirements can be 
demonstrated and verified. 

• Low fidelity propellant depletion and safing operations requirements can be established. 

• Long term propellant vapor effects can be demonstrated (if testing or exposure durations 
are adequately extended). 

• Ground processing procedures and operations with verification of associated 
requirements (provided adequate fidelity of the flight system is captured in the test 
article design). 
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• Assessment and verification of sensitive design areas due to propellant contamination 
and air reaction effects, including areas such as valving soft goods, seals, and propellant 
mechanical interfaces. 

3. An integrated pressurization system test (with flight-like avionics/software aspects) can 
demonstrate the following: 

• Verification of the time constraint requirements involving system controller and system 
valve(s) response times. 

• Mode of operation requirements can be established and verified. 

Due to the complexity, cost and schedule associated with propulsion system level hot 
fire testing, further discussion of this method of verification is provided in the following section. 


Hot Fire Altitude Test 

Engine performance verification is highly dependent on the need for altitude testing. 
Engine testing at vacuum conditions verifies engine thermal response, thrust performance, and 
high/low frequency instability concerns. For new development engines where qualification has 
not been completed, propulsion system level altitude testing can be necessary to evaluate 
engine combustion effects with propulsion feedsystem interaction. Altitude testing is typically 
used when backpressure and thermal requirements are critical to the verification process. The 
following test objectives and requirements can be verified with altitude testing (either at the 
engine or propulsion system levels): 

1 . Engine thrust performance at vacuum conditions (usually performed at the engine level, 
but often supplemented at the system level with verification of feedsystem and thruster 
interactions). 

2. Engine thermal interaction with other engines (verified either through engine level testing 
with correlated thermal modeling to address multiple thruster interactions or through 
propulsion system level hot fire testing). This can be eliminated if insulation techniques 
are used to suppress convective heat transfer. 

3. Combustion instability concerns with engine start-up transients (usually performed at the 
engine level, but often supplemented at the system level with verification of feedsystem 
and thruster interactions). 

4. Propulsive operations, such as propellant depletion for safing operations (applicable if 
the vacuum chamber can pull a low ambient test chamber pressure level below the 
freezing point of propellants). 

5. Thruster performance for various nozzle configurations (usually performed at the engine 
level). 

6. Thruster minimum impulse bit (MIB) and effects of vacuum (usually performed at the 
engine level). 

If economical budget concerns influence the verification program, ambient propulsion 
system hot fire testing at sea level conditions can address the majority of the system level 
altitude testing objectives. Typically this method is used where backpressure and thermal 
characteristics are not critical to the test objectives/verification process: 

1. All items under the hot fire test article can be achieved with ambient conditions, with the 
exception of the items 1 through 6 listed under altitude test (which can be at least 
partially addressed with thruster level altitude hot fire testing). 

2. Feed system dynamic evaluation and maximum/minimum ullage pressure requirements 
can be established or verified. 

3. Propellant and pressurization system performance with nominal and off nominal 
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conditions can be verified. 


4. Software and valve sequencing requirements can be verified. 

There is a significant cost increase and schedule impact to build-up and test at a specific 
altitude. In some cases, the test objectives can be met without simulated altitude; however, it is 
noted that the sage adage of testing the system under conditions fully representative of expected 
flight environmental and operational conditions has much validity, as both unexpected conditions 
and anomalous operations can best be detected under a rigorous flight-like testing program and 
the overall system operation and verification is best proven under flight-like conditions. The 
following critical areas are recommended areas of emphases for verification: 

1 . Demonstrate and verify system-operating characteristics over the predicted operating 
pressure range. 

2. Demonstrate and verify nominal and off-nominal conditions (i.e. bound the operating 
limits). Define the operating requirements for ullage pressures, mixture ratios (MRs), 
flowrates and temperature. 

3. Demonstrate and verify pulse and steady-state engine duty cycles for specific mission 
duty cycles for multiple engines. Verify mission duty cycle requirements. 

4. Investigate the effects of helium saturation as a function of tank pressure for various 
engine duty cycles. Define and verify the operating limits of the system. 

5. Evaluate and verify engine and propellant feed system dynamics under potential engine 
“chug” instability conditions as well as worst case dynamic MDCs. Verify the low inlet 
pressure requirements will not cause low frequency instability. Evaluate system dynamic 
response when engine chug instability is present. 

6. Verify engine/system stability under defined operating envelopes. 

7. Avionics software verification in conjunction with propulsion system operation 

8. Address long duration propellant exposure effects 

9. Demonstrate and verify ground processing processes and requirements and impacts 
associated with a propellant contaminated system. 


Engine Instability 

If system/engine instability is encountered during testing, the next topic provides some 
background information and provides recommendations for processing through the verification 
process. Two types of instabilities associated with liquid rocket engines can develop with storable 
systems. Low frequency and high frequency combustion instability are two areas of concerns that 
need to be retired before qualifying the system with the associated engines. 

Low frequency instability less than 1000 Hz is referred to as “chug”. Characteristics of 
chugging instability involve rough chamber pressure indications where low inlet pressures or 
helium bubbles in propellants cause low frequency instability. This may be detrimental to engines 
(e.g., affect film cooling); however, it will also result in unpredictable propellant consumption with 
resultant off-nominal propellant consumptions and mission performance short falls. This area is 
usually not influenced by engine start-up conditions; however, it will produce feed system 
oscillations if chug frequency couples with system natural frequency. 

High frequency greater than 6000 Hz is referred to as combustion instability. If the 
engine is well defined and significant development testing has been captured, high frequency 
combustion instability is usually not a concern. However, helium ingested by the engines can 
induce erratic behavior, as can fuel and oxidizer lead and lag commanding. Random chamber 
pressure oscillations are indicative of high frequency instability. These conditions occur at start- 
up transients as well as when other transients affecting the combustion process occur and 
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typically are captured at development or qualification engine testing. High frequency instability 
can develop where a new system configuration causes gaseous helium to evolve out of solution, 
and may be a particular concern or risk where the ingested gaseous helium is significantly 
beyond levels demonstrated with the engine design. 


Test Options 


A test program should define the required objectives needed to address the technical 
concerns and the overall verification requirements. Every flight propulsion system design is 
unique and has its own derived verification process based on complexity, design heritage, and 
program-accepted level of risk and cost and schedule constraints. The following are the X-37 
propulsion system test areas that were evaluated to be critical to the success of the program. 


1. Verification of system dynamics during initial system priming. 

2. Verification of operating requirements of key fluid components, during normal and failure 
mode operating conditions 

3. Verification of acceptable fluid dynamics during simulated normal and worst-case engine 
duty cycles. 

4. Generation of flow calibration data to be used during system assembly and for cold flow 
calibration testing. 

5. Evaluation and verification of long duration pneumatic system vapor exposure effects 

6. Verification of response times for an integrated pressurization system with avionics and 
software interaction. 


7. Verification of feed system steady state and dynamic pressure interactions for the 
operating range of thruster/engine MDCs. 

8. Verification of propellant depletion operation and requirements 

9. Evaluation and verification of long term propellant interactions (iron nitrate formation and 
associated impacts) 

10. Evaluation and verification of ground environment operations for a propellant- 
contaminated system (iron nitrate/leakage evaluations) 

1 1 . Verification of procedures for processing of propellant contaminated propulsion system 

Testing at ambient conditions for the X-37 propulsion system is recommended if 
sufficient qualification testing of the engines is available. For the X-37 program, ambient testing 
is an acceptable method for verification because feed system dynamics will not be affected by 
altitude effects (i.e. delta-P and flowrates conditions can be demonstrated by various tank 
pressures). Engine operating envelopes can be demonstrated and verification of off-nominal 
operating conditions and requirements are addressed for any chugging concerns. With this test 
setup, propellant saturation effects will also be evaluated. 

As a minimum, the test article should implement the following physical characteristics 
representative of the flight propulsion system design: 

• Flow characteristics (match flow impedance of propulsion system). 

• Mounting characteristics (i.e., simulate stiffness of flight structure where possible). 

• Tubing bends and 90 degree fittings are recommended. Long runs of tubing coiled to 
minimize space are acceptable. 

When high or low frequency instability is unexpectedly encountered, test setup and test 
article repeatability are key to assure specific pressures, temperatures and flowrates associated 
with the instability are identified. With adequate data capture and understanding of conditions 
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which caused the condition, it can be possible to develop an operating envelope to avoid the 
instability (particularly in the case of chug instability). By evaluating the envelope, hardware 
changes can also be realized to avoid the instability domains (particularly in the case of chug 
instability). Examples of this would include avoiding low inlet pressures, minimizing pressure 
drops in the feedsystem by changing filter configurations, minimizing sharp bends that could trap 
evolved helium gas, and re-orificing of the feedsystem to avoid overall large pressure drops. 
These recommendations need to be considered against the program objectives as they may 
entail impacts to the overall system requirements. 


Summary and conclusions 

This paper provides an outline for reviewing a propulsion system requirements and 
defining the types of testing required to address the necessary test objectives for verification. It is 
assumed that the structure of deriving and defining requirements is allocated to system and 
component specifications for further development. It is not necessary that fully mature 
requirements be established at the onset, but rather identified such that these requirements can 
be used to derive a suitable test article for later maturing of the verification requirements. What 
is essential for selecting the types of test for verification are: 

1 . Configuration options for propulsion (and specifically fluid) system hot fire or cold flow 
test articles. 

2. A test matrix that address the requirements of the system and component specification. 

3. A test plan that addresses the questionable design areas and verifies the requirements 

Balancing the scope of test verification will require an understanding of the allowed 
budget and schedule to assure successful formulation of a verification program. With these 
information sets, a trade between a hot and cold test will guide a design team to the proper 
choice for verification. Considering the following will aid the selection between hot or cold flow 
testing. 

When engine performance has been demonstrated, and acceptance of a deviation from 
the adage of “test as you fly and fly as you test’, a cold flow test can be recommended to 
demonstrate the following (assuming simulated fluids): 

• Anchoring of math model for MDC simulations, with limited insight into feed system 
interactions 

• Feed system, pneumatic system activation and surge pressure performances can be 
verified with respect to requirements. 

• Low fidelity propellant depletion can be verified. 

• Safing operational requirements can be verified. 

• Control of the pressurization with avionics/software interaction (i.e. evaluate system 
controller and system response). 

A. Items that cannot be demonstrated with a cold flow test (assuming simulated fluids): 

• Thruster chamber pressure feedback interaction with system. 

• Simulated fluids do not have identical fluid properties (i.e. models need to address the 
variation of fluid property differences). 

• Helium solubility effects in propellant due to use of simulated fluids. 

• Vapor migration effects and environmental effects/reactions with materials. 

• Thruster/engine heat soak back effects are not simulated. 

• Processing and de-contamination tests will be different, and the effects of propellant 
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related contamination effects will not be addressed. 

B. Cold flow test with propellants can demonstrate the following: 

• Verify the anchoring of models for MDC simulations, with insight (limited) into feed 
system interactions 

• Verify the feed system and pneumatic system activation and surge pressures 
requirements. 

• Verify with low fidelity the propellant depletion requirements 

• Verify safing operations requirements. 

• Verify long term propellant vapor effects, assuming adequate exposure duration is 
provided 

• Verify ground processing procedural tests (assuming adequate test article fidelity to the 
flight system) 

• Development of and insight into ground processing operations and processes 

• Evaluation and potential verification of sensitive design areas due to propellant- 
contaminated/air reaction effects (such as valving soft goods, seals and mechanical 
propellant interfaces) 

Assuming actual propellants are used, issues that cannot be verified with a cold flow test 

include: 


• Thruster chamber pressure feedback interactions with system. 

• Thruster/engine heat soak back effects. 

C. Items that cannot be addressed by analysis and similarity: 

• Combustion/thruster interaction with the feed system capacitance and associated 
environments (high and low frequency combustion pressure oscillations and feed system 
capacitance interaction with multiple engines). 

• Thermal environments (i.e. , no convection in space) - system can be simulated to 
achieve simulated environments by insulating the propellant Lines. 

• Helium saturation, contamination, life degradation (e.g. aging of soft goods exposed to 
propellants & repeated fatigue of ground environments), reusability of hardware with 
ground environments (i.e. NTO reacting with ambient conditions), propellant vapor 
transport and other effects not easily or accurately modeled. 

• Integrated avionics/software/propulsion interaction time delays, responses and overall 
performance with flight hardware. 

• Ground processing of the actual flight configuration (and development and validation of 
associated procedures). 

• Assumptions and unknown issues not anticipated or beyond the experience base of the 
designers. 


Conclusions 


Three types of test article can be selected to resolve the technical issues and provide a 
means for certifying a propulsion system. Careful identification of design issues and 
requirements is required to identify the type of test needed. The authors have provided the trade 
exercise accomplished on a reference program (X-37) and have consulted with Space Shuttle 
and NASA Jet Propulsion Laboratory (JPL) propulsion engineers to arrive at the 
recommendations provided. Included are lessons learned from the Space Shuttle programs and 
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NASA JPL Cassini Program. 


acknowledgments 

The authors would like to thank the NASA JPL and MSFC agencies for their extensive 
experience in accumulated information from Space Shuttle, JPL long term space vehicles and 
MSFC propulsion systems. 


references 

1. Boeing Reusable Space System, Non-Toxic System Architecture for Space Shuttle 
Applications, AIAA-98-3821 , July 12-15, 1998. 

2. Boeing Reusable Space System, Non-Toxic Cryogenic Storage for OMS/RCS Shuttle 
Upgrade, AIAA-98-3821 , July 1 2-1 5, 1 998 

3. Boeing Internal Study/Henry Rodriguez, Boeing Supportability and Obsolescence Study, 
2001 . 

4. Boeing Reusable Space Systems, Main Propulsion System Maintainability Issues for 
the Future Shuttle, AIAA-02-3756, July 7-1 0, 2002. 


Approved for public release; distribution is unlimited. 



